Linking operational events with system changes

ABSTRACT

In an approach to linking operational data with issues, a new event is received. The new event is associated to a story, where the story is related to an identified problem within the system, and further where the new event is associated with the story using machine learning techniques. The story is associated to related change requests based on a similarity between the story and related change requests, where the similarity between the story and the related change requests is associated using the machine learning techniques. A cost is calculated for the story. Responsive to associating the new event with a specific change request, the priority of the specific change request is updated based on the cost for the story.

BACKGROUND

The present invention relates generally to the field of informationtechnology, and more particularly to linking operational data withissues.

Site reliability engineering is a discipline that incorporates aspectsof software engineering and applies them to infrastructure andoperations problems. The main goals are to create scalable and highlyreliable software systems.

DevOps is a set of practices that combines software development andInformation Technology (IT) operations. It aims to shorten the systemsdevelopment life cycle and provide continuous delivery with highsoftware quality. DevOps is complementary with Agile softwaredevelopment; several DevOps aspects came from Agile methodology. DevOpscore principles—involvement of the IT function in each phase of designand development of a system, heavy reliance on automation versus humaneffort, the application of engineering practices and tools to operationstasks—are consistent with many of the principles and practices of sitereliability engineering. One could view DevOps as a generalization ofseveral core site reliability engineering principles to a wider range oforganizations, management structures, and personnel. One couldequivalently view site reliability engineering as a specificimplementation of DevOps with some idiosyncratic extensions.

A change request is a proposal to alter a software program or system,often brought up by the client or another team member. Change requestscan originate from various sources including customers, end users, theproject team, or the test team. Changes from customers and end userswould normally be changes in their requirements, from the project teamcould come design changes, and the testing team could request codechanges due to errors discovered during testing. Changes arecommunicated to a Site Reliability Engineer (SRE) using a Change Request(CR) form. The CR typically contains details of the project, module andcomponent which are likely to be affected by the CR and may includereasons for the CR.

Change management in software development involves tracking and managingchanges to artifacts, such as code and requirements. It is critical foreffective application development. The change management process in sitereliability engineering is the process of requesting, determiningattainability, planning, implementing, and evaluating changes to asystem. Its main goals are to support the processing and traceability ofchanges to an interconnected set of factors.

SUMMARY

Embodiments of the present invention disclose a method, a computerprogram product, and a system for linking operational data with issues.In one embodiment, a new event is received. The new event is associatedto a story, where the story is related to an identified problem withinthe system, and further where the new event is associated with the storyusing machine learning techniques. The story is associated to relatedchange requests based on a similarity between the story and relatedchange requests, where the similarity between the story and the relatedchange requests is associated using the machine learning techniques. Acost is calculated for the story. Responsive to associating the newevent with a specific change request, the priority of the specificchange request is updated based on the cost for the story.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a functional block diagram illustrating a distributed dataprocessing environment, in accordance with an embodiment of the presentinvention.

FIG. 2 is an example use case of the story linking program, inaccordance with an embodiment of the present invention.

FIG. 3 is an example of a system-level overview of linking data to astory, in accordance with an embodiment of the present invention.

FIG. 4 is an example of creating a story, in accordance with anembodiment of the present invention.

FIG. 5 is a flowchart depicting operational steps of the story linkingprogram, on a computing device within the distributed data processingenvironment of FIG. 1, for linking operational data with issues, inaccordance with an embodiment of the present invention.

FIG. 6 depicts a block diagram of components of the computing devicesexecuting the story linking program within the distributed dataprocessing environment of FIG. 1, in accordance with an embodiment ofthe present invention.

DETAILED DESCRIPTION

The core of DevOps is to achieve product development that is responsiveto the realities of operations. In a DevOps environment, after an SREhas resolved an incident, it may be appropriate to request a softwarechange intended to prevent recurrences of that issue by issuing a changerequest. Having created the change request, it is then up to thedevelopers to prioritize it along with other fixes and new features. Aquantitative, objective metric for the impact of a particular changerequest would allow the developers to improve that prioritization, andmaximize their effective impact on operations.

The present invention achieves this by linking operational observationsinto stories. A story is a the story is a collection of past incidents,current incidents, system alerts, comments, including SRE comments,related changes, and other artifacts, such as the incidents and eventsresulting from a single software bug. When a change request results froman incident, it is desirable to link it to any past occurrences, andespecially to keep it updated when new occurrences are discovered. Bylinking the change request to a story, the present invention allows thedevelopment team to correctly prioritize the is sue.

In one example use case, an event is generated because application X isreturning “Server Error” 500-series codes (a very general HTTP statuscode). An incident is created, along with an associated story. Anengineer investigates, discovers a call in the code is using adeprecated system call to a standard internal module, and works aroundit by manually enabling a legacy compatibility mode on that othermodule. The engineer closes the incident and adds a change request tothe application development team for correcting the outdated call. Twodays later, the system is restarted during routine maintenance, makingthe manual workaround no longer active. The server errors return and arelinked to the existing story by the present invention. The current storyallows the recovery to be faster this time, while also automaticallyincreasing the priority of the change request to reflect the additionalrecovery effort and downtime, giving it more visibility in the nextsprint planning meeting. In this example, since the change request waslinked to the story describing the outdated call, the present inventionled to a much timelier, and likely less expensive, resolution to theissue.

In an embodiment, the present invention links software change requeststo documented examples of the failure that must be resolved. Thisimproves the clarity of the description, and simplifies the design ofunit tests to validate the change. In an embodiment, the presentinvention discovers previous occurrences of the underlying problem andlinks them with the change request. In an embodiment, the presentinvention automatically links ongoing instances of the underlyingproblem to the change request, even if they occur after the request wascreated. Discussions from the entire story are therefore available tothe development team that builds the fix.

In the context of this description, the following conventions, termsand/or expressions may be used:

The term ‘alert’ may denote some detectable problem spotted by amonitoring system (e.g., high CPU, series 500 HTTP response, low disk,etc.).

The term ‘anomaly’ may denote that a machine learning system hasidentified patterns (e.g., system logs) that are normal, and discoveredsomething anomalous (e.g., abnormally many “connection failed” messages,unusual combination of container restarts and pull failures, etc.).

The term ‘incident’ may denote something has gone wrong with theproduction environment, and someone has been assigned to investigate.

The term ‘event’ may denote some detected thing that may indicatetrouble (e.g., either an alert or an anomaly).

The term ‘change request’ may denote an object containing a request forchanging the production environment, including approvals, and a closingstatus for whether the change was successful, failed, succeeded withdifficulty, etc., and may also include comments on the solution and anydifficulties that were encountered.

The term ‘story’ may denote the system object created by the presentinvention to allow experts to discuss an ongoing incident and to receiveupdates of any newly relevant events or changes that have beendiscovered.

FIG. 1 is a functional block diagram illustrating a distributed dataprocessing environment, generally designated 100, suitable for operationof story linking program 112 in accordance with at least one embodimentof the present invention. The term “distributed” as used hereindescribes a computer system that includes multiple, physically distinctdevices that operate together as a single computer system. FIG. 1provides only an illustration of one implementation and does not implyany limitations with regard to the environments in which differentembodiments may be implemented. Many modifications to the depictedenvironment may be made by those skilled in the art without departingfrom the scope of the invention as recited by the claims.

Distributed data processing environment 100 includes computing device110 connected to network 120. Network 120 can be, for example, atelecommunications network, a local area network (LAN), a wide areanetwork (WAN), such as the Internet, or a combination of the three, andcan include wired, wireless, or fiber optic connections. Network 120 caninclude one or more wired and/or wireless networks that are capable ofreceiving and transmitting data, voice, and/or video signals, includingmultimedia signals that include voice, data, and video information. Ingeneral, network 120 can be any combination of connections and protocolsthat will support communications between computing device 110 and othercomputing devices (not shown) within distributed data processingenvironment 100.

Computing device 110 can be a standalone computing device, a managementserver, a web server, a mobile computing device, or any other electronicdevice or computing system capable of receiving, sending, and processingdata. In an embodiment, computing device 110 can be a laptop computer, atablet computer, a netbook computer, a personal computer (PC), a desktopcomputer, a personal digital assistant (PDA), a smart phone, or anyprogrammable electronic device capable of communicating with othercomputing devices (not shown) within distributed data processingenvironment 100 via network 120. In another embodiment, computing device110 can represent a server computing system utilizing multiple computersas a server system, such as in a cloud computing environment. In yetanother embodiment, computing device 110 represents a computing systemutilizing clustered computers and components (e.g., database servercomputers, application server computers) that act as a single pool ofseamless resources when accessed within distributed data processingenvironment 100.

In an embodiment, computing device 110 includes story linking program112. In an embodiment, story linking program 112 is a program,application, or subprogram of a larger program for linking operationaldata with issues. In an alternative embodiment, story linking program112 may be located on any other device accessible by computing device110 via network 120.

In an embodiment, computing device 110 includes information repository114. In an embodiment, information repository 114 may be managed bystory linking program 112. In an alternate embodiment, informationrepository 114 may be managed by the operating system of the device,alone, or together with, story linking program 112. Informationrepository 114 is a data repository that can store, gather, compare,and/or combine information. In some embodiments, information repository114 is located externally to computing device 110 and accessed through acommunication network, such as network 120. In some embodiments,information repository 114 is stored on computing device 110. In someembodiments, information repository 114 may reside on another computingdevice (not shown), provided that information repository 114 isaccessible by computing device 110. Information repository 114 includes,but is not limited to, CR data, issue data, story data, event data, userdata, system configuration data, and other data that is received bystory linking program 112 from one or more sources, and data that iscreated by story linking program 112.

Information repository 114 may be implemented using any volatile ornon-volatile storage media for storing information, as known in the art.For example, information repository 114 may be implemented with a tapelibrary, optical library, one or more independent hard disk drives,multiple hard disk drives in a redundant array of independent disks(RAID), solid-state drives (SSD), or random-access memory (RAM).Similarly, the information repository 114 may be implemented with anysuitable storage architecture known in the art, such as a relationaldatabase, an object-oriented database, or one or more tables.

FIG. 2 is an example use case of the story linking program, inaccordance with an embodiment of the present invention. In this example,failing software system 210 is an application that is running andreturning an error code, e.g., “Server Error”. Events are reported tostory linking program 112, including new event 212 and existing event214. It should be noted that “new event” and “existing event” are usedfor clarity of the example to distinguish between events associated witha new, or not previously encountered, incidents versus events associatedwith existing, or previously encountered incidents. In actual operation,they are just “events”, and are not distinguished by story linkingprogram 112. An event indicates a potential system problem, and can be,for example, that a CPU load is higher than a predetermined threshold,or that a user has experienced a “500-series server error.” In thisexample, new event 212 refers to an event that was encountered for thefirst time, and leads to a new CR to be created by an SRE, whileexisting event 214 refers to an event that was previously encounteredand is associated with an existing CR by story linking program 112.

New event 212 and existing event 214 are received by story linker 220,which is the main function of story linking program 112. If storylinking program 112 determines that the events are related, the eventsare grouped together. Story linking program 112 then associates theevent groups with stories, which represent incidents being resolved. Ifstory linking program 112 determines that the events are not alreadyassociated with an incident, then story linking program 112 creates anew incident and sends incident 222 to monitoring platform 230 with theassociated story. Monitoring platform 230 is the SRE platform that isused by site engineering to monitor ongoing incidents and track changerequests. Notification 232 is then sent to the appropriate SRE 240 bymonitoring platform 230. In the case of a new incident, SRE 240 manuallycreates a new change request for the developers, which is sent bynotification 242 to collaborative development platform 250, which allowsthe developers to collaborate with story linking program 112. In anembodiment, the new CR is received by story linking program 112 to addto its database of change requests.

If story linking program 112 determines that the events are alreadyassociated with a story, then story linking program 112 automaticallyreports the incident to collaborative development platform 250 with theassociated story via existing incident 224. If story linking program 112determines that the priority of the associated change request shouldchange, then story linking program 112 sends the recommendation of thenew priority with the incident.

In an embodiment, collaborative development platform 250 then notifiesthe developers 260 associated with the change request via either newchange request 252 or existing change request 254.

In an embodiment, in the process of generating the relevant annotationsfor a story, story linking program 112 receives change requests whenthey seem relevant, such as when they would have been likely to eitherhave caused the current problem (i.e., because they affect the system introuble, and have recently been enacted, or closed, in production), orto have solved the current problem (i.e., presumably changes that arecurrently open, i.e. not yet in production).

Both of these sets of changes (closed and open) are relevant to the SREinvestigating the story, but changes that remains open are relevant tothe management team in general, especially if it might have preventedthe incident that is currently costing time and effort. Story linkingprogram 112 provides a link back to the change request management systemthat will assist the prioritization of changes by adding visibility tothe costs being incurred due to delayed implementation of the CR.

FIG. 3 is an example of a system-level overview of linking data to astory, in accordance with an embodiment of the present invention. Inthis example, story 310 is the story created by story linking program112. Story 310 contains references to the change request and othercomprehensive information about the anomaly in a monitored softwaresystem. When a story has been created, it is associated with varioussystem objects, including change requests 320, incidents 322, andindividual alerts 324. Similarly, when a new change request is created,it is linked to a story. Incident alerts 330 are the incidents receivedby story linking program 112, e.g., new event 212 and existing event 214from FIG. 2, and may include anything that causes an incidentinvestigation to start (e.g., a customer calls in, an internal event israised that power has been lost to a server room, a monitoring systemhas noticed 10% of attempted purchases being declined by the credit cardvalidation system, etc.). Incident alerts 330 may include indications ofthe repair cost. Individual alerts 324 includes all of incident alerts330, and also others that did not cause an incident investigation (e.g.server response time slower than usual, a high-availability cluster hasfailed over to backup, etc.). The story needs to include all of thisinformation to allow the SRE to have the best possible picture to workfrom.

FIG. 4 is an example of creating a story, in accordance with anembodiment of the present invention. In this example, story linkingprogram 112 is reactively monitoring the target system by trackingevents, anomalies, and incidents, and propagates this data into internalcomponents. Internal components such as grouping service 410 andincident similarity service 412 are responsible for enhancing theoriginal data by adding insights that allow a better understanding ofthe problem that occurred in the target product. In an embodiment,adding insights may include the identification of similar incidents thathave previously occurred, especially when those incidents have beenlinked to a “Root Cause Analysis” report; the ability to see other workon similar ongoing incidents, reducing the duplication of effort bySREs; and highlighting relevant system events, which is important in anenvironment that contains many routine alerts that are not relevant(e.g., alerts on unrelated subsystems).

After the data is enhanced by the internal components, it is propagatedinto the generic message queue system 420 (shown by data streams 414 and416), which monitors the target software product by tracking events,anomalies, and incidents, and then propagates this data into themicroservices, e.g., grouping service 410 and incident similarityservice 412. Generic message queue system 420 also receives reportedevents 430 and reported incidents 440, which are processed and publishedby generic message queue system 420. All of this data is passed to storyservice 450, which is the main function of story linking program 112.Story service 450 creates stories 460 from this data.

FIG. 5 is a flowchart for the steps for the story linking program, forlinking operational data with issues, in accordance with an embodimentof the present invention. In an alternative embodiment, the steps ofworkflow 500 may be performed by any other program while working withstory linking program 112. In an embodiment, story linking program 112receives a new event. In an embodiment, story linking program 112associates the received event with related incidents, both past andongoing. In an embodiment, story linking program 112 determines if thereceived event is related to an existing story. In an embodiment, storylinking program 112 creates a new story based on the received event. Inan embodiment, story linking program 112 links the received event withthe related story as determined previously. In an embodiment, storylinking program 112 updates the associated change request with the newdata from the received event. In an embodiment, story linking program112 evaluates the story to determine a cost that will be used to set thepriority of the associated change request. In an embodiment, storylinking program 112 determines whether this is a new change request oran existing change request. In an embodiment, if story linking program112 determines that this is an existing change request, then storylinking program 112 updates the priority of the existing change requestbased on the additional information from the new incidents. Storylinking program 112 then returns to the first step to receive the nextevent. In an embodiment, if story linking program 112 determines thatthis is a new change request, then story linking program 112 notifiesthe SRE making the change request of a recommended initial prioritysetting for the change request, based on the information in the story.Story linking program 112 then returns to the first step to receive thenext event.

It should be appreciated that embodiments of the present inventionprovide at least for linking operational data with issues. However, FIG.5 provides only an illustration of one implementation and does not implyany limitations with regard to the environments in which differentembodiments may be implemented. Many modifications to the depictedenvironment may be made by those skilled in the art without departingfrom the scope of the invention as recited by the claims.

Story linking program 112 receives an event (step 502). In anembodiment, story linking program 112 receives a new event. In anembodiment, an event refers to any type of system event, including analert. Events may be threshold crossings such as “high CPU,” timeoutssuch as “system not responding,” user events such as “web site isreturning 500-series server failure codes”, and so on. In an embodiment,story linking program 112 reactively monitors the target software systemby tracking events, anomalies, and incidents from the target system, andpropagating this data into internal components. In an embodiment,internal components, e.g., grouping service 410 and incident similarityservice 412 from FIG. 4, are responsible for enhancing the original databy adding insights that allow a better understanding of the occurredproblem in the target product.

Story linking program 112 associates the event with related incidents(step 504). In an embodiment, story linking program 112 associates thereceived event with related incidents, both past and ongoing, from acorpus of incidents. In an embodiment, after the data is enhanced by theinternal components in step 502, the data is input into the storyservice of story linking program 112. In an embodiment, the storyservice identifies how and what information needs to be aggregatedtogether to represent a story. In an embodiment, story linking program112 uses machine learning techniques to associate the received eventwith related incidents. In various embodiments, the machine learningtechniques may include, but is not limited to, logistic regression,random forest, passive aggressive classifiers, support-vector machines,also called also support-vector networks, and apriori algorithmimplementations. In another embodiment, story linking program 112 usesneural networks to associate the received event with related incidents.In yet another embodiment, story linking program 112 uses longshort-term memory RNNs.

Story linking program 112 determines if the event is related to anexisting story (decision block 506). In an embodiment, story linkingprogram 112 determines if the received event is related to an existingstory. In an embodiment, story linking program 112 uses classificationto determine if the event is related to an existing story. In variousembodiments, the classification may include, but is not limited to,logistic regression, random forest, passive aggressive, andsupport-vector machines, also called also support-vector networks. Inanother embodiment, story linking program 112 uses neural networks todetermine if the event is related to an existing story. In variousembodiments, the neural networks may include, but is not limited to,long short-term memory.

If story linking program 112 determines that the received event isrelated to an existing story (“yes” branch, decision block 506), thenstory linking program 112 proceeds to step 510. If story linking program112 determines that the received event is not related to an existingstory (“no” branch, decision block 506), then story linking program 112proceeds to step 508 to create a new story.

Story linking program 112 creates a new story (step 508). In anembodiment, story linking program 112 creates a new story based on thereceived event. The procedure to create a new story is explained in FIG.4 above.

Story linking program 112 associates the story with related changes(step 510). In an embodiment, story linking program 112 links thereceived event with the story to which it was determined to be relatedin decision block 506. In an embodiment, story linking program 112 linksthe software change requests to documented examples of the failure thatthey must address. This improves the clarity of the description, andsimplifies the design of unit tests to validate the change. In anembodiment, story linking program 112 discovers previous occurrences ofthe underlying problem and links them with the change request. In anembodiment, story linking program 112 automatically links ongoinginstances of the underlying problem to the change request, even if theyoccur after the request was created.

Story linking program 112 updates the change request with the relatedchanges (step 512). In an embodiment, story linking program 112 updatesthe associated change request with the new data from the received event.In an embodiment, story linking program 112 evaluates the story todetermine a cost that will be used to update the priority of theassociated change request. In an embodiment, the cost may include, butis not limited to, downtime, number of person hours to repair,service-level agreement violations, and other factors. In an embodiment,story linking program 112 updates the change request with the updatedcost. In this way, story linking program 112 makes discussions from theentire story available to the development team that builds the fix.

Story linking program 112 evaluates the story to determine its cost(step 514). In an embodiment, story linking program 112 evaluates thestory to determine a cost that will be used to set the priority of theassociated change request. In an embodiment, the cost may include, butis not limited to, downtime, number of person hours to repair,service-level agreement violations, and other factors. In an embodiment,story linking program 112 may receive the cost, for example, in a rootcause analysis report. In another embodiment, story linking program 112may derive the cost based on the number of individual contributors tothe resolution (story), the length of time the incident remained “open”,the text analysis of the comments added during resolution, or usingother methods to derive a cost from context as would be known to aperson having skill in the art.

Story linking program 112 determines if this is a new change request(decision block 516). In an embodiment, story linking program 112determines whether this is a new change request or an existing changerequest. In another embodiment, story linking program 112 receives thedetermination whether this is a new change request or an existing changerequest from an SRE. In an embodiment, if story linking program 112determines that this is a new change request (“yes” branch, decisionblock 516), then story linking program 112 proceeds to step 520. In anembodiment, if story linking program 112 determines that this is not anew change request (“no” branch, decision block 516), then story linkingprogram 112 proceeds to step 518.

Story linking program 112 updates the priority of the change request(step 518). In an embodiment, if story linking program 112 determinesthat this is an existing change request, then story linking program 112updates the priority of the existing change request based on theadditional information from the new events. Story linking program 112then returns to step 502 to receive the next event.

Story linking program 112 suggests an initial priority of the changerequest (step 520). In an embodiment, if story linking program 112determines that this is a new change request, then story linking program112 sends a notification to the SRE making the change request withadvice of a recommended initial priority setting for the change request,based on the information in the story. Story linking program 112 thenreturns to step 502 to receive the next event.

FIG. 6 is a block diagram depicting components of computing device 110suitable for story linking program 112, in accordance with at least oneembodiment of the invention. FIG. 6 displays computer 600; one or moreprocessor(s) 604 (including one or more computer processors);communications fabric 602; memory 606, including random-access memory(RAM) 616 and cache 618; persistent storage 608; communications unit612; I/O interfaces 614; display 622; and external devices 620. Itshould be appreciated that FIG. 6 provides only an illustration of oneembodiment and does not imply any limitations with regard to theenvironments in which different embodiments may be implemented. Manymodifications to the depicted environment may be made.

As depicted, computer 600 operates over communications fabric 602, whichprovides communications between computer processor(s) 604, memory 606,persistent storage 608, communications unit 612, and I/O interface(s)614. Communications fabric 602 may be implemented with any architecturesuitable for passing data or control information between processors 604(e.g., microprocessors, communications processors, and networkprocessors), memory 606, external devices 620, and any other hardwarecomponents within a system. For example, communications fabric 602 maybe implemented with one or more buses.

Memory 606 and persistent storage 608 are computer readable storagemedia. In the depicted embodiment, memory 606 comprises RAM 616 andcache 618. In general, memory 606 can include any suitable volatile ornon-volatile computer readable storage media. Cache 618 is a fast memorythat enhances the performance of processor(s) 604 by holding recentlyaccessed data, and near recently accessed data, from RAM 616.

Program instructions for story linking program 112 may be stored inpersistent storage 608, or more generally, any computer readable storagemedia, for execution by one or more of the respective computerprocessors 604 via one or more memories of memory 606. Persistentstorage 608 may be a magnetic hard disk drive, a solid-state disk drive,a semiconductor storage device, read only memory (ROM), electronicallyerasable programmable read-only memory (EEPROM), flash memory, or anyother computer readable storage media that is capable of storing programinstruction or digital information.

The media used by persistent storage 608 may also be removable. Forexample, a removable hard drive may be used for persistent storage 608.Other examples include optical and magnetic disks, thumb drives, andsmart cards that are inserted into a drive for transfer onto anothercomputer readable storage medium that is also part of persistent storage608.

Communications unit 612, in these examples, provides for communicationswith other data processing systems or devices. In these examples,communications unit 612 includes one or more network interface cards.Communications unit 612 may provide communications through the use ofeither or both physical and wireless communications links. In thecontext of some embodiments of the present invention, the source of thevarious input data may be physically remote to computer 600 such thatthe input data may be received, and the output similarly transmitted viacommunications unit 612.

I/O interface(s) 614 allows for input and output of data with otherdevices that may be connected to computer 600. For example, I/Ointerface(s) 614 may provide a connection to external device(s) 620 suchas a keyboard, a keypad, a touch screen, a microphone, a digital camera,and/or some other suitable input device. External device(s) 620 can alsoinclude portable computer readable storage media such as, for example,thumb drives, portable optical or magnetic disks, and memory cards.Software and data used to practice embodiments of the present invention,e.g., story linking program 112, can be stored on such portable computerreadable storage media and can be loaded onto persistent storage 608 viaI/O interface(s) 614. I/O interface(s) 614 also connect to display 622.

Display 622 provides a mechanism to display data to a user and may be,for example, a computer monitor. Display 622 can also function as atouchscreen, such as a display of a tablet computer.

The programs described herein are identified based upon the applicationfor which they are implemented in a specific embodiment of theinvention. However, it should be appreciated that any particular programnomenclature herein is used merely for convenience, and thus theinvention should not be limited to use solely in any specificapplication identified and/or implied by such nomenclature.

The present invention may be a system, a method, and/or a computerprogram product. The computer program product may include a computerreadable storage medium (or media) having computer readable programinstructions thereon for causing a processor to carry out aspects of thepresent invention.

The computer readable storage medium can be any tangible device that canretain and store instructions for use by an instruction executiondevice. The computer readable storage medium may be, for example, but isnot limited to, an electronic storage device, a magnetic storage device,an optical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. A non-exhaustive list of more specific examples of thecomputer readable storage medium includes the following: a portablecomputer diskette, a hard disk, a random access memory (RAM), aread-only memory (ROM), an erasable programmable read-only memory (EPROMor Flash memory), a static random access memory (SRAM), a portablecompact disc read-only memory (CD-ROM), a digital versatile disk (DVD),a memory stick, a floppy disk, a mechanically encoded device such aspunch-cards or raised structures in a groove having instructionsrecorded thereon, and any suitable combination of the foregoing. Acomputer readable storage medium, as used herein, is not to be construedas being transitory signals per se, such as radio waves or other freelypropagating electromagnetic waves, electromagnetic waves propagatingthrough a waveguide or other transmission media (e.g., light pulsespassing through a fiber-optic cable), or electrical signals transmittedthrough a wire.

Computer readable program instructions described herein can bedownloaded to respective computing/processing devices from a computerreadable storage medium or to an external computer or external storagedevice via a network, for example, the Internet, a local area network, awide area network and/or a wireless network. The network may comprisecopper transmission cables, optical transmission fibers, wirelesstransmission, routers, firewalls, switches, gateway computers and/oredge servers. A network adapter card or network interface in eachcomputing/processing device receives computer readable programinstructions from the network and forwards the computer readable programinstructions for storage in a computer readable storage medium withinthe respective computing/processing device.

Computer readable program instructions for carrying out operations ofthe present invention may be assembler instructions,instruction-set-architecture (ISA) instructions, machine instructions,machine dependent instructions, microcode, firmware instructions,state-setting data, or either source code or object code written in anycombination of one or more programming languages, including an objectoriented programming language such as Smalltalk, C++ or the like, andconventional procedural programming languages, such as the “C”programming language or similar programming languages. The computerreadable program instructions may execute entirely on the user'scomputer, partly on the user's computer, as a stand-alone softwarepackage, partly on the user's computer and partly on a remote computeror entirely on the remote computer or server. In the latter scenario,the remote computer may be connected to the user's computer through anytype of network, including a local area network (LAN) or a wide areanetwork (WAN), or the connection may be made to an external computer(for example, through the Internet using an Internet Service Provider).In some embodiments, electronic circuitry including, for example,programmable logic circuitry, field-programmable gate arrays (FPGA), orprogrammable logic arrays (PLA) may execute the computer readableprogram instructions by utilizing state information of the computerreadable program instructions to personalize the electronic circuitry,in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general-purpose computer, a special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, a segment, or aportion of instructions, which comprises one or more executableinstructions for implementing the specified logical function(s). In somealternative implementations, the functions noted in the blocks may occurout of the order noted in the Figures. For example, two blocks shown insuccession may, in fact, be executed substantially concurrently, or theblocks may sometimes be executed in the reverse order, depending uponthe functionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

The descriptions of the various embodiments of the present inventionhave been presented for purposes of illustration but are not intended tobe exhaustive or limited to the embodiments disclosed. Manymodifications and variations will be apparent to those of ordinary skillin the art without departing from the scope and spirit of the invention.The terminology used herein was chosen to best explain the principles ofthe embodiment, the practical application or technical improvement overtechnologies found in the marketplace, or to enable others of ordinaryskill in the art to understand the embodiments disclosed herein.

What is claimed is:
 1. A computer-implemented method for linkingoperational data with issues, the computer-implemented methodcomprising: receiving, by one or more computer processors, a new event;associating, by the one or more computer processors, the new event to astory, wherein the story is related to an identified problem within thesystem, and further wherein the new event is associated with the storyusing one or more machine learning techniques; associating, by the oneor more computer processors, the story to one or more related changerequests, based on a similarity between the story and the one or morerelated change requests, wherein the similarity between the story andthe one or more related change requests is associated using the one ormore machine learning techniques; calculating, by the one or morecomputer processors, a cost for the story; and responsive to associatingthe new event with a specific change request, updating, by the one ormore computer processors, a priority of the specific change requestbased on the cost for the story.
 2. The computer-implemented method ofclaim 1, wherein the one or more machine learning techniques includes atleast one of a logistic regression, a random forest, passive aggressiveclassifiers, support-vector machines, and apriori algorithmimplementations.
 3. The computer-implemented method of claim 1, whereinthe story is a collection of at least one of one or more past incidents,one or more current incidents, one or more system alerts, one or morecomments, one or more related changes, and one or more other artifacts.4. The computer-implemented method of claim 1, wherein the one or morerelated change requests includes one or more past change requests andone or more current change requests.
 5. The computer-implemented methodof claim 1, wherein responsive to associating the new event with thespecific change request, updating the priority of the specific changerequest based on the cost for the story further comprises: determining,by the one or more computer processors, if the specific change requestis a new change request; and responsive to determining that the specificchange request is the new change request, sending, by the one or morecomputer processors, a notification of the priority of the specificchange request to a user, wherein the notification is advice of arecommended initial priority for the new change request.
 6. Thecomputer-implemented method of claim 1, wherein the cost for the storyincludes at least one of a downtime, a number person hours to repair,and one or more service-level agreement violations.
 7. Thecomputer-implemented method of claim 1, wherein responsive toassociating the new event with the specific change request, updating thepriority of the specific change request based on the cost for the storyfurther comprises: updating, by the one or more computer processors, thespecific change request with the new event; and sending, by the one ormore computer processors, the specific change request to a changetracking system.
 8. A computer program product for linking operationaldata with issues, the computer program product comprising one or morecomputer readable storage media and program instructions stored on theone or more computer readable storage media, the program instructionsincluding instructions to: receive a new event; associate the new eventto a story, wherein the story is related to an identified problem withinthe system, and further wherein the new event is associated with thestory using one or more machine learning techniques; associate the storyto one or more related change requests, based on a similarity betweenthe story and the one or more related change requests, wherein thesimilarity between the story and the one or more related change requestsis associated using the one or more machine learning techniques;calculate a cost for the story; and responsive to associating the newevent with a specific change request, update a priority of the specificchange request based on the cost for the story.
 9. The computer programproduct of claim 8, wherein the one or more machine learning techniquesincludes at least one of a logistic regression, a random forest, passiveaggressive classifiers, support-vector machines, and apriori algorithmimplementations.
 10. The computer program product of claim 8, whereinthe story is a collection of at least one of one or more past incidents,one or more current incidents, one or more system alerts, one or morecomments, one or more related changes, and one or more other artifacts.11. The computer program product of claim 8, wherein the one or morerelated change requests includes one or more past change requests andone or more current change requests.
 12. The computer program product ofclaim 8, wherein responsive to associating the new event with thespecific change request, update the priority of the specific changerequest based on the cost for the story further comprises one or more ofthe following program instructions, stored on the one or more computerreadable storage media, to: determine if the specific change request isa new change request; and responsive to determining that the specificchange request is the new change request, send a notification of thepriority of the specific change request to a user, wherein thenotification is advice of a recommended initial priority for the newchange request.
 13. The computer program product of claim 8, wherein thecost for the story includes at least one of a downtime, a number personhours to repair, and one or more service-level agreement violations. 14.The computer program product of claim 8, wherein responsive toassociating the new event with the specific change request, update thepriority of the specific change request based on the cost for the storyfurther comprises one or more of the following program instructions,stored on the one or more computer readable storage media, to: updatethe specific change request with the new event; and send the specificchange request to a change tracking system.
 15. A computer system forlinking operational data with issues, the computer system comprising:one or more computer processors; one or more computer readable storagemedia; and program instructions stored on the one or more computerreadable storage media for execution by at least one of the one or morecomputer processors, the stored program instructions includinginstructions to: receive a new event; associate the new event to astory, wherein the story is related to an identified problem within thesystem, and further wherein the new event is associated with the storyusing one or more machine learning techniques; associate the story toone or more related change requests, based on a similarity between thestory and the one or more related change requests, wherein thesimilarity between the story and the one or more related change requestsis associated using the one or more machine learning techniques;calculate a cost for the story; and responsive to associating the newevent with a specific change request, update a priority of the specificchange request based on the cost for the story.
 16. The computer systemof claim 15, wherein the one or more machine learning techniquesincludes at least one of a logistic regression, a random forest, passiveaggressive classifiers, support-vector machines, and apriori algorithmimplementations.
 17. The computer system of claim 15, wherein the storyis a collection of at least one of one or more past incidents, one ormore current incidents, one or more system alerts, one or more comments,one or more related changes, and one or more other artifacts.
 18. Thecomputer system of claim 15, wherein the one or more related changerequests includes one or more past change requests and one or morecurrent change requests.
 19. The computer system of claim 15, whereinresponsive to associating the new event with the specific changerequest, update the priority of the specific change request based on thecost for the story further comprises one or more of the followingprogram instructions, stored on the one or more computer readablestorage media, to: determine if the specific change request is a newchange request; and responsive to determining that the specific changerequest is the new change request, send a notification of the priorityof the specific change request to a user, wherein the notification isadvice of a recommended initial priority for the new change request. 20.The computer system of claim 15, wherein responsive to associating thenew event with the specific change request, update the priority of thespecific change request based on the cost for the story furthercomprises one or more of the following program instructions, stored onthe one or more computer readable storage media, to: update the specificchange request with the new event; and send the specific change requestto a change tracking system.